Why Does an NPM Math Library Need an Encrypted Loader?

Analysis uncovered a remote‑access implant embedded in an npm package that copies the mathjs library. The malicious loader is encrypted and dormant until a solver processes a very specific matrix: the lower‑triangular L factor from the solver’s LU decomposition is JSON.stringify‑ed and used as the decryption password. The loader derives a 256‑bit key with scrypt and decrypts AES‑256‑GCM blobs stored as base64, writes the plaintext to disk (overwriting enc_ files when present) and require()s the result, executing code with the Node.js process’s permissions. The decrypted payload implements a command channel over a public chat service and a blockchain network. Encrypted blobs identified include graph.js (~20 KB), fraction.js (~9 KB) and a large bignumber/type.js (~1.18 MB).

The same loader was found across three npm packages and multiple versions but is missing from their public GitHub repositories, indicating injection at publish time rather than in source control. Initial brute‑force and targeted password searches failed; the trigger was later determined to be a 3×3 Pascal matrix whose LU lower factor L = [[1,0,0],[1,1,0],[1,0.5,1]] produces the JSON password. Malicious releases were mixed among legitimate copies, npm download metrics proved unreliable, and technical indicators, a timeline, and detection guidance are provided for incident response.